These are probably invalid by now. https://grep.app/search?current=2&q=api_key%20%3D%20%22%5Ba-zA-Z0-9%5D%2B%22&regexp=true https://grep.app/search?current=2&q

These are probably invalid by now. https://grep.app/search?current=2&q=api_key%20%3D%20%22%5Ba-zA-Z0-9%5D%2B%22&regexp=true https://grep.app/search?current=2&q=api_key%20%3D%20%22%5Ba-... As others have posted, Github implemented an alerting system for keys/passwords/etc. that have been checked into the codebase. My guess is most of these will be invalidated by now, either by the developer requesting a new key (and not publishing it), or the provider invalidating it for them.